Skip to content

Embed go version in go install binaries in cache #481

@SgtCoDFish

Description

@SgtCoDFish

The problem I had:

  1. Months ago, I interact with a repository and run make verify-govulncheck. This installs govulncheck to ~/.cache/makefile-modules/downloaded/tools/govulncheck@v1.1.4_darwin_arm64, built with go 1.24.x

  2. In the following months, go is upgraded to 1.25.x, but the version of govulncheck is not bumped.

  3. I run make verify-govulncheck today and it results in a huge swathe of errors:

...
~/workspace/cert-manager-csi-driver-spiffe/test/e2e/suite/import.go:17:1: package requires newer Go version go1.25 (application built with go1.24)
-: This application uses version go1.24 of the source-processing packages but runs version go1.25 of 'go list'. It may fail to process source files that rely on newer language features. If so, rebuild the application using a newer version of Go.

The issue is that govulncheck was built with go1.24 but is testing an application using go1.25. Removing the cached version so govulncheck is rebuilt with go1.25 fixes the issue.

We could embed the go version in the cached binary name; this would mean that we'd rebuild go install dependencies when either their version, or go's version changes. e.g. we could save govulncheck as:

~/.cache/makefile-modules/downloaded/tools/govulncheck@go1.25.2@v1.1.4_darwin_arm64

(The actual format of how we embed the go version is irrelevant, though)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions